CVE-2025-36065
📋 TL;DR
IBM Sterling Connect:Express Adapter for Sterling B2B Integrator versions 5.2.0.00 through 5.2.0.12 fails to properly invalidate user sessions when a browser is closed, allowing authenticated users to potentially impersonate other users. This affects organizations using the vulnerable versions of this IBM B2B integration software.
💻 Affected Systems
- IBM Sterling Connect:Express Adapter for Sterling B2B Integrator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could hijack another user's session after they close their browser, gaining unauthorized access to sensitive B2B integration data and functions as that user.
Likely Case
Authenticated users with access to shared workstations could inadvertently or intentionally access another user's session, leading to unauthorized data access or actions.
If Mitigated
With proper session management controls and workstation security, the risk is limited to accidental session reuse on properly secured systems.
🎯 Exploit Status
Exploitation requires authenticated access and access to the same workstation where a user previously closed their browser without logging out
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.0.13 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7257244
Restart Required: Yes
Instructions:
1. Download IBM Sterling B2B Integrator 5.2.0.13 or later from IBM Fix Central. 2. Apply the update following IBM's standard patching procedures. 3. Restart the Sterling B2B Integrator services.
🔧 Temporary Workarounds
Enforce manual logout
allRequire users to manually log out of the application before closing browsers
Implement session timeout
allConfigure application or web server to enforce session timeouts
🧯 If You Can't Patch
- Implement strict workstation usage policies requiring manual logout
- Deploy web application firewalls with session fixation protection
🔍 How to Verify
Check if Vulnerable:
Check the version of IBM Sterling Connect:Express Adapter in your Sterling B2B Integrator installationCheck Version:
Check the version in the Sterling B2B Integrator administration console or installation directoryVerify Fix Applied:
Verify the version is 5.2.0.13 or higher after applying the patch📡 Detection & Monitoring
Log Indicators:
- Multiple user sessions from same IP/workstation in quick succession
- User account accessing unusual functions
Network Indicators:
- Session cookies being reused after browser closure
SIEM Query:
source="sterling_b2b" AND (event_type="session_start" OR event_type="authentication") | stats count by user, src_ip | where count > 1